// Compile into an existing signed test driver; this file has no DriverEntry.
#ifndef DOMITO_CI_PROBE_HOST_TEST
#include <ntifs.h>
#include "Domito.MinCrypt.h"
#endif
#include "ci-file-object-probe.h"

_IRQL_requires_max_(PASSIVE_LEVEL)
void
DomitoProbeCiValidateFileObject(
    PFILE_OBJECT FileObject,
    DOMITO_CI_PROBE_RESULT* Results
)
{
    const ULONG flags[DOMITO_CI_PROBE_RESULT_COUNT] = {
        0,
        DOMITO_CI_VALIDATE_FLAG_BROADEN_ROOT_ACCEPTANCE,
        DOMITO_CI_VALIDATE_FLAG_BROADEN_ROOT_ACCEPTANCE,
        0,
        0,
        DOMITO_CI_VALIDATE_FLAG_BROADEN_ROOT_ACCEPTANCE
    };

    for (ULONG i = 0; i < DOMITO_CI_PROBE_RESULT_COUNT; ++i)
    {
        MINCRYPT_POLICY_INFO policy = {};
        MINCRYPT_POLICY_INFO timestamp = {};
        policy.Size = sizeof(policy);
        timestamp.Size = sizeof(timestamp);

        struct
        {
            UCHAR Bytes[MINCRYPT_MAX_HASH_LENGTH];
            ULONG Guard;
        } hash = {};

        hash.Guard = 0xD01170AB;
        DOMITO_CI_PROBE_RESULT& result = Results[i];
        result = {};
        result.Flags = flags[i];
        result.InputCapacity = i < 4 ? sizeof(hash.Bytes) : sizeof(hash.Bytes) - 1;
        result.HashSize = result.InputCapacity;
        result.Status = CiValidateFileObject(
            FileObject,
            result.Flags,
            0,
            &policy,
            &timestamp,
            &result.SigningTime,
            hash.Bytes,
            &result.HashSize,
            &result.HashAlgId
        );
        result.HashGuardIntact = hash.Guard == 0xD01170AB;
        // Keep failure outputs as raw observations; only successful calls have
        // a usable digest. Do not dereference the incompletely mapped chains.
        result.PolicyBits = policy.PolicyBits;
        result.TimeStampPolicyBits = timestamp.PolicyBits;
        result.VerificationStatus = (NTSTATUS)policy.VerificationStatus;
        result.TimeStampVerificationStatus = (NTSTATUS)timestamp.VerificationStatus;
        result.HasChain = policy.ChainInfo != nullptr;
        result.HasTimeStampChain = timestamp.ChainInfo != nullptr;

        if (NT_SUCCESS(result.Status) && result.HashSize <= sizeof(result.Hash))
        {
            RtlCopyMemory(result.Hash, hash.Bytes, result.HashSize);
        }

        CiFreePolicyInfo(&policy);
        CiFreePolicyInfo(&timestamp);
    }
}